Security & Trust
A trust constitution, not a trust badge.
These commitments are architectural. They shape the data model, the permission layer and the interface language — they are not a page written after the fact.
The individual comes first.
Where interests conflict, the person at the centre is the design priority.
Relationship does not imply access.
Being connected to someone grants no visibility into their Passport.
Authority must be proven.
Guardianship, power of attorney and executorship require evidence, scope and expiry.
Consent should be understandable.
Purpose, scope and duration in plain language, versioned and revocable.
Data disclosure should be minimised.
Each party sees the least necessary to fulfil the stated purpose.
Provenance should be visible.
Every fact carries its origin, its time and its asserting party.
Disputed information stays visibly disputed.
No silent overwriting. Both versions remain, marked.
Coverage must be honest.
Unconnected sources are reported as unconnected, never implied as clear.
Security is a product feature.
Encryption, session integrity, device awareness and audit are user-visible.
Jurisdiction matters.
Rules, residency and redress travel with the Country Pack.
AI cannot manufacture legal truth.
Assistance is explanatory. It never asserts entitlement or legal status.
Government access is never blanket surveillance.
Access is per purpose, per mandate, per record, and always logged.
Controls
What that looks like in practice.
Access log
Every read of your relationship data, by whom, under which consent and purpose.
Consent registry
Grants, versions, expiries and withdrawals, all visible to the person.
Device & session
Active sessions, device recognition and step-up verification for sensitive actions.
Protection states
Normal, enhanced verification and compromised-identity postures with clear consequences.